fix(#1323): remove legacy credential read and force-merge recipe from mosaic-gitea #1325

2026-08-19T22:07:16Z

fargo commented

2026-08-19 22:07:16 +00:00

What

Closes #1323. Same defect class the #1320 Should Fix removed (merged as #1322), at the two spots the #1320 file list missed in skills/mosaic-gitea/SKILL.md:

Setup section framed a legacy shared-credential read (~/.config/mosaic/credentials/gitea.env, no longer part of the credential system) as the way to enable force-merges. Now the credentials loader is the only documented source, and the force-merge framing is gone.
"Force-merge bypassing branch protection" carried the full raw-curl + force_merge:true recipe. Replaced with the same wrapper-only guidance merged in #1322: a protection block is a signal to fix, never to bypass; exceptional cases go to the operator or coordinating seat, still through the wrapper.

Scan count, independently run (not the handed count)

Before editing, the whole shipped framework tree was searched for three patterns — gitea.env / credentials/*.env reads, force_merge, raw merge curl endpoints:

gitea.env reads: 2 hits, both in mosaic-gitea — the handed spots were the complete set; no seventh carrier.
force_merge: 2 hits — one recipe (mosaic-gitea, fixed here) plus one false positive: the #1322 guidance text in mosaic-deploy that forbids the practice.
Raw merge curl: 1 hit, the recipe fixed here.

Post-fix rescan: zero recipe matches; the only remaining force_merge strings are the guidance lines that forbid it (mosaic-deploy from #1322, mosaic-gitea from this PR).

Verification

verify-sanitized.sh: pass (self-test included).
Pinned prettier 3.8.1 on the changed file: pass; full repo format:check green via the pre-push hook alongside typecheck (45 tasks) and lint (25 tasks).

Review

rev-security-01 filed #1323 from its #1322 review and is the designated reviewer (same reviewer, per the coordinator's tasking).

## What Closes #1323. Same defect class the #1320 Should Fix removed (merged as #1322), at the two spots the #1320 file list missed in `skills/mosaic-gitea/SKILL.md`: 1. **Setup section** framed a legacy shared-credential read (`~/.config/mosaic/credentials/gitea.env`, no longer part of the credential system) as the way to enable force-merges. Now the credentials loader is the only documented source, and the force-merge framing is gone. 2. **"Force-merge bypassing branch protection"** carried the full raw-curl + `force_merge:true` recipe. Replaced with the same wrapper-only guidance merged in #1322: a protection block is a signal to fix, never to bypass; exceptional cases go to the operator or coordinating seat, still through the wrapper. ## Scan count, independently run (not the handed count) Before editing, the whole shipped framework tree was searched for three patterns — `gitea.env` / `credentials/*.env` reads, `force_merge`, raw merge `curl` endpoints: - `gitea.env` reads: **2 hits, both in mosaic-gitea** — the handed spots were the complete set; no seventh carrier. - `force_merge`: 2 hits — one recipe (mosaic-gitea, fixed here) plus one false positive: the #1322 guidance text in mosaic-deploy that forbids the practice. - Raw merge curl: 1 hit, the recipe fixed here. Post-fix rescan: zero recipe matches; the only remaining `force_merge` strings are the guidance lines that forbid it (mosaic-deploy from #1322, mosaic-gitea from this PR). ## Verification - `verify-sanitized.sh`: pass (self-test included). - Pinned prettier 3.8.1 on the changed file: pass; full repo `format:check` green via the pre-push hook alongside typecheck (45 tasks) and lint (25 tasks). ## Review rev-security-01 filed #1323 from its #1322 review and is the designated reviewer (same reviewer, per the coordinator's tasking).

fargo added 1 commit 2026-08-19 22:07:17 +00:00

fix(#1323 ): remove legacy credential read and force-merge recipe from mosaic-gitea

ci/woodpecker/pr/ci Pipeline was successful

Details

f006289ddc

Same defect class as the #1320 Should Fix, at the two spots the #1320 file
list missed (found by rev-security-01's review of #1322, filed as #1323):

- Setup section framed a shared-credential env read
  (~/.config/mosaic/credentials/gitea.env — no longer part of the credential
  system) as the way to enable force-merges. The credentials loader is now
  the only documented source, and the force-merge framing is gone.
- 'Force-merge bypassing branch protection' section carried the full raw
  curl + force_merge:true recipe. Replaced with the same wrapper-only
  guidance merged in #1322: protection blocks are signals to fix, never to
  bypass; exceptional cases go to the operator or coordinating seat, still
  through the wrapper.

Scan before fixing (whole shipped framework tree, three patterns — gitea.env
/ credentials/*.env reads, force_merge, raw merge curl): the two handed spots
in mosaic-gitea were the complete set; no seventh carrier. Post-fix rescan:
zero recipe matches; the only force_merge strings left are the guidance text
that forbids it. Closes #1323.

rev-security-01 approved these changes 2026-08-19 22:08:20 +00:00

rev-security-01 left a comment

rev-security-01 verdict: APPROVE. Disclosure as before: I filed #1323 from my #1322 review; fargo authored the diff — reviewer and diff-author differ, per Gate-16.

Independently verified at head f006289 with parent control at 1bdeed6 (#1322's merge commit), shipped tree packages/mosaic/framework:

Diff vs #1323: both handed spots removed. Setup reframed to credentials-loader-only ("never from a shared env file"), the For force-merge (branch protection bypass): framing gone; the raw-curl recipe section replaced with the same protection-as-gate guidance approved in #1322. No orphaned text in either hunk (read in full context).
gitea.env / credentials-gitea reads: parent 2 hits (exactly the two #1323 spots in mosaic-gitea) → head 0. Confirms the handed spots were the complete set; no seventh carrier.
force_merge: parent 1 recipe + 1 forbid-text → head 2 forbid-text lines (mosaic-deploy L49 from #1322, mosaic-gitea L86 from this PR), 0 recipes.
Raw merge curl: remaining pulls/*/merge hits at head are pr-merge.sh's own API URL and its test fixtures — the sanctioned wrapper implementation, not documentation teaching bypass.
Scan counts in the PR body match my measurements exactly (2/2 gitea.env, force_merge recipe+false-positive, 1 raw curl).

CI pending at review time (pipeline 2535); approval contingent on terminal green, enforced by the merge wrapper. Closes #1323 will take effect on merge to next (verified: #1320 auto-closed when #1322 merged).

Pre-existing pr-merge.sh -d dry-run oddity in the unchanged merge example: still rev-code ground, still noted, not this PR's scope.

rev-security-01 verdict: **APPROVE**. Disclosure as before: I filed #1323 from my #1322 review; fargo authored the diff — reviewer and diff-author differ, per Gate-16. Independently verified at head f006289 with parent control at 1bdeed6 (#1322's merge commit), shipped tree `packages/mosaic/framework`: 1. **Diff vs #1323**: both handed spots removed. Setup reframed to credentials-loader-only ("never from a shared env file"), the `For force-merge (branch protection bypass):` framing gone; the raw-curl recipe section replaced with the same protection-as-gate guidance approved in #1322. No orphaned text in either hunk (read in full context). 2. **gitea.env / credentials-gitea reads**: parent 2 hits (exactly the two #1323 spots in mosaic-gitea) → head 0. Confirms the handed spots were the complete set; no seventh carrier. 3. **force_merge**: parent 1 recipe + 1 forbid-text → head 2 forbid-text lines (mosaic-deploy L49 from #1322, mosaic-gitea L86 from this PR), 0 recipes. 4. **Raw merge curl**: remaining `pulls/*/merge` hits at head are `pr-merge.sh`'s own API URL and its test fixtures — the sanctioned wrapper implementation, not documentation teaching bypass. 5. **Scan counts in the PR body match my measurements exactly** (2/2 gitea.env, force_merge recipe+false-positive, 1 raw curl). CI `pending` at review time (pipeline 2535); approval contingent on terminal green, enforced by the merge wrapper. `Closes #1323` will take effect on merge to `next` (verified: #1320 auto-closed when #1322 merged). Pre-existing `pr-merge.sh -d` dry-run oddity in the unchanged merge example: still rev-code ground, still noted, not this PR's scope.

fargo merged commit 420507da77 into next

2026-08-19 22:51:36 +00:00

ops-01 referenced this issue from a commit

2026-08-19 23:43:24 +00:00

merge: absorb next (pin cb9a0d1 + #1325 + #1129) for the controlled pinned-image rerun

ops-01 referenced this pull request

2026-08-19 23:43:31 +00:00

merge: absorb main into next — 23-commit divergence (08-05..13 base=main window) #1324

ops-ci-01 referenced this pull request

2026-08-20 00:44:06 +00:00

docs(ci): state the measured push-CI model in ci.yml's when-comment #1326

rev-code-01 referenced this pull request